Kavita versions 0.9.0 through 0.9.1.4 expose a server‑side request forgery flaw that allows authenticated users to submit a URL to the upload‑cbl‑file endpoint. After the URL passes a blocklist check, DNS rebinding or HTTPS redirects can cause the server to resolve to internal IPs, enabling blind probing of internal ports and services. The vulnerability permits only authenticated users; it does not grant remote code execution or privilege escalation but can reveal internal network topology and potentially expose additional weaknesses.

The flaw affects Kavita server releases 0.9.0 to 0.9.1.4. Users running these versions, under any operating environment, are impacted. This includes all deployments of Kareadita's Kavita that have not yet been upgraded beyond 0.9.1.4.

The CVSS score of 2.3 indicates low overall severity, largely because the attacker must be authenticated and the impact is limited to internal network probing. EPSS data is not available, and KEV listing is absent, suggesting no known large‑scale exploitation to date. Nonetheless, the vulnerability can be leveraged by an attacker with legitimate credentials to map internal services, which may assist in planning further attacks. The primary attack vector is via the authenticated POST to /api/Cbl/upload-cbl-file with a crafted URL that resolves internally after validation.